Can I place fuzzers to the project instead of the OSS-Fuzz repository?

[vy]

Abstract: AFAIU, currently all fuzzers are stored in the google/oss-fuzz repository. I am considering making fuzzers part of the actual project and only providing integration scripts in the google/oss-fuzz repository. Is this okay?

---

I am a Log4j maintainer and currently Log4j fuzzers are stored under projects/log4j2 of the google/oss-fuzz repository. I am considering to do

1. Move fuzzers to the apache/logging-log4j2 repository. As a result,
   • The project maintainers will take the responsibility of maintaining the fuzzers as a part of the project itself. (For instance, right now the Log4j fuzzers are outdated and they don't even compile.)
   • Users will be able to run fuzz tests themselves: ./mvnw -P fuzz test
2. Provide only integration scripts in the projects/log4j2 of the google/oss-fuzz repository. To be precise, provide only Dockerfile and build.sh to generate foo_fuzzer, bar_fuzzer, etc. executables. (To be more precise, foo_fuzzer will forward to ./mvnw -P fuzz test -Dtest=FooFuzzer.)

Would such an approach have any certain drawbacks I am not able to see? What are your thoughts?

[maflcko]

According to https://google.github.io/oss-fuzz/advanced-topics/ideal-integration/ it is the recommended ideal integration.

[vy]

@maflcko, I had the same impression, but I failed to find an example under projects/ that adhere to that principle. Do you know of any (preferably a Java project) that I can check?

[maflcko]

Sure, some examples:

• https://github.com/google/oss-fuzz/tree/master/projects/sigstore-java
• https://github.com/google/oss-fuzz/tree/master/projects/keycloak

Not sure if there is one where the build is passing, though.